TL;DR: Passwords remain one of the top two initial access vectors, while banks face account takeover fraud, credential stuffing, and relay attacks that bypass SMS and push-based MFA, according to RSA Security and the 2026 Verizon DBIR. FIDO2 passkeys and post-quantum planning shift the control point from shared secrets to cryptographic assurance and regulatory readiness.
At a glance
What this is: This is RSA Security's analysis of why banking authentication is moving to phishing-resistant identity, with FIDO2 passkeys framed as the clearest response to credential attacks and emerging regulatory requirements.
Why it matters: It matters because IAM teams in banking must treat authentication as a fraud-control, compliance, and cryptographic roadmap problem, not just a login-experience upgrade.
Context
Banking authentication now sits at the intersection of fraud reduction, customer assurance, and regulatory compliance. When shared secrets, SMS one-time codes, and push approvals remain in the login path, attackers can still exploit phishing proxies, SIM swap abuse, and help desk social engineering to reach financial accounts.
Phishing-resistant identity matters here because the bank is not just proving a user knows something or has something. It is proving that the authentication event is bound to the legitimate relying party and cannot be replayed, relayed, or phished through a copycat site.
That makes this a governance problem as much as a technical one. Institutions have to align enrollment, recovery, transaction signing, third-party contracts, and cryptographic planning around one question: does the authentication architecture still depend on secrets an attacker can intercept?
Key questions
Q: Where do phishing-resistant banking controls fail in practice?
A: They fail when the bank hardens primary login but leaves recovery, help desk, or fallback authentication paths exposed. Attackers often bypass the strongest factor by targeting the weakest trusted path, such as SMS resets, manual verification, or push-approval coercion. A phishing-resistant architecture only works when the whole identity journey is governed to the same standard.
Q: Why do banks need phishing-resistant authentication instead of stronger MFA?
A: Stronger MFA still fails if the second factor can be relayed, intercepted, or approved under pressure. Phishing-resistant authentication matters because it binds the credential to the real relying party and removes the shared secret that makes phishing economical. For banks, that reduces account takeover risk and improves the evidence story for regulators.
Q: How do IAM teams know whether passwordless adoption is actually working?
A: They should look for fewer lockouts, fewer reset requests, shorter time to access, and lower dependence on help desk intervention. Adoption is only successful if the new method is secure and easier for employees to use than the old one. Metrics should show both improved assurance and reduced operational drag.
Q: What should banks do when phishing-resistant authentication meets regulatory scrutiny?
A: They should map the authentication design to PSD3, PSR1, and DORA as one governance problem rather than three separate reviews. That means documenting phishing resistance, dynamic linking where required, alternative authenticator support, and operational continuity evidence before supervisory questions become audit findings.
Technical breakdown
Why shared secrets fail in banking authentication
Password-based banking flows create a shared-secret problem: the bank and the customer both rely on something that can be copied, phished, replayed, or socially engineered. Even when MFA is added, SMS OTPs and push approvals are still vulnerable to real-time phishing proxies and fatigue attacks because the second factor can be relayed or coerced. In practice, the weakness is not only the password itself but the authentication ceremony built around it. Banking attackers target the path of least resistance, which is usually the recovery flow, help desk, or approval step that still trusts a human to recognise fraud in real time.
Practical implication: treat password removal as incomplete unless recovery and approval paths are also phishing-resistant.
How FIDO2 passkeys change the authentication model
FIDO2 replaces shared secrets with public-key cryptography. The device generates a key pair, the private key stays on the device, and the bank stores only the public key. During login, the bank issues a challenge and the device signs it, which means there is no credential for an attacker to steal, intercept, or reuse. Domain binding is the other critical property: the credential only works for the legitimate relying party, so a convincing phishing site cannot accept it. That shifts assurance from user judgement to cryptographic proof, which is why FIDO2 maps so cleanly to phishing-resistant authentication goals.
Practical implication: prioritise FIDO2 where login assurance must survive phishing, replay, and lookalike-site attacks.
Why post-quantum planning belongs in the same roadmap
Banks cannot treat post-quantum cryptography as a distant research topic. FIDO2, TLS, and signature systems all depend on asymmetric cryptography that quantum computers could eventually break, which creates a long-tail exposure even before quantum machines are commercially practical. The article highlights the harvest-now, decrypt-later threat, where adversaries archive encrypted traffic today for future decryption. That means authentication roadmaps now have two horizons: immediate phishing resistance and longer-term cryptographic durability. Institutions that only solve the first problem will still need to revisit the foundations later.
Practical implication: inventory the cryptographic algorithms used in authentication flows and map a migration path to post-quantum standards.
Threat narrative
Attacker objective: The attacker’s objective is to obtain authenticated access that can be converted into account takeover and financial theft.
- Entry begins when attackers use credential stuffing, real-time phishing proxies, or SIM swap support abuse to get into banking authentication flows.
- Credential access follows when the attacker captures passwords, one-time codes, or push approvals that were never designed to resist relay or replay.
- Impact occurs when the attacker reaches account takeover fraud, transfers value, or abuses authenticated banking sessions at scale.
Breaches seen in the wild
- 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.
- SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Phishing-resistant authentication is now a banking governance requirement, not a usability upgrade. The article shows that passwords, SMS codes, and push prompts remain exploitable because attackers target the surrounding human and help desk workflows, not just the login field. That means authentication decisions now affect fraud loss, regulatory posture, and assurance design together. For practitioners, the control question is no longer whether MFA exists, but whether the method can survive relay, replay, and coercion.
Passkeys move assurance from shared-secret management to cryptographic binding. FIDO2 matters because it changes the unit of trust from a reusable secret to a domain-bound key pair, which is materially harder to phish or replay. That makes the authentication event a cryptographic assertion instead of a user memory test. For IAM teams, the practical result is that identity assurance can finally be designed around the properties of the authenticator rather than the behavior of the user.
Banking authentication now has to be governed as a multi-horizon control set. Immediate phishing resistance solves the current fraud problem, but post-quantum planning addresses the cryptographic lifetime of the system itself. That combination is why authentication roadmaps can no longer be reduced to a single deployment project. Practitioners need to think in terms of present-day adversary resistance and future cryptographic survivability at the same time.
Account recovery is the hidden dependency that can undo passwordless gains. The article correctly points to recovery and help desk flows as common weak points, because a phishing-resistant primary factor does not compensate for a recoverable back door built on weaker identity proofing. The same is true of third-party authentication contracts and audit records. For banks, the operational lesson is to govern the whole lifecycle, not just the login ceremony.
Phishing resistance and regulatory readiness are converging into the same control objective. PSD3, PSR1, and DORA push banks toward demonstrable, auditable authentication methods that reduce fraud and support continuity. That convergence makes FIDO2 a governance anchor rather than a niche technical option. The practitioner implication is to align authentication design, audit evidence, and resilience planning under one programme owner.
What this signals
Phishing-resistant banking identity is becoming a lifecycle issue, not a login feature. Once passkeys are in scope, teams have to govern enrollment, recovery, device trust, and fallback handling as part of the same control boundary. The practical test is whether a user can still be phished through an adjacent path after the primary password is gone.
Account takeover risk is migrating from the credential to the workflow around the credential. That is why passwordless programmes fail when help desk verification, alternate authenticator routing, or manual exception handling remain weaker than the primary method. IAM teams should therefore review every recovery dependency before declaring the environment passwordless.
Post-quantum readiness should be planned as an authentication architecture decision. Banks that treat cryptographic migration as a later project risk rebuilding authentication twice. The better programme view is to map today’s phishing-resistant controls against the algorithms and key lifetimes they depend on, then sequence change before the transition becomes urgent.
For practitioners
- Replace shared-secret login paths Prioritise FIDO2 or equivalent phishing-resistant authentication for customer and staff flows where account takeover risk is highest, especially online banking and privileged access.
- Eliminate weak recovery back doors Review enrollment, account recovery, and help desk verification paths for password resets, SMS fallback, and manual override steps that undermine the primary authenticator.
- Separate authenticator assurance by user population Use device-bound passkeys or hardware security keys for high-risk roles, while allowing synced passkeys only where recovery and device trust assumptions are acceptable.
- Build post-quantum migration into the roadmap Inventory the cryptographic algorithms used in authentication, digital signatures, and transport protection so you can sequence a move toward post-quantum standards.
- Align third-party contracts with resilience requirements Check authentication service contracts for availability, incident notification, audit rights, and continuity obligations that support regulatory review and operational resilience.
Key takeaways
- Passwords and SMS-based factors still leave banks exposed to phishing, replay, and credential stuffing, even when MFA is present.
- The strongest control shift is from shared secrets to domain-bound cryptographic authentication that cannot be relayed to a fake site.
- Banks should govern recovery, third-party dependencies, and post-quantum cryptography alongside the primary passkey rollout.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST SP 800-53 Rev 5, NIST SP 800-63 and NIST CSF 2.0 set the technical controls, and PCI DSS v4.0 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centers on replacing phishable banking authentication with phishing-resistant identity. |
| Recommendation — Use phishing-resistant authenticators to remove replayable login secrets from banking flows. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article discusses lifecycle control of passwords, passkeys, and recovery authenticators. |
| Recommendation — Manage authenticators so enrollment, recovery, and replacement do not weaken the primary factor. | ||
| NIST SP 800-63 | SP 800-63B — Authentication | The article maps directly to phishing-resistant authentication and assurance in digital banking. |
| Recommendation — Apply phishing-resistant authentication guidance to raise assurance and reduce fraud exposure. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Authentication assurance is central to controlling who can access banking systems and accounts. |
| Recommendation — Align authentication strength with access authorization decisions for high-risk banking journeys. | ||
| PCI DSS v4.0 | 8.4.2 — MFA for access into the CDE | The banking authentication discussion overlaps with payment-security expectations for strong authentication. |
| Recommendation — Use MFA and phishing-resistant methods where payment or cardholder environments are in scope. | ||
Key terms
- Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
- Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
- Dynamic Linking: A transaction integrity control that binds authentication to the payment amount and payee. If either changes, the authentication code is no longer valid, which helps stop substitution attacks and prevents a legitimate approval from being reused for a different transfer.
- Harvest now, decrypt later: An attacker strategy where encrypted traffic or stored data is collected today and decrypted later when better computing power becomes available. It matters to NHI governance because machine identities often protect the data paths and secrets most worth preserving over time.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 4, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org